feat(session): every reconnect starts a fresh session

SOCKS5 Reconnect re-attached to the session the device already held. It
was the only path where a session began without an ad and without a
nonce binding it to one, and supporting it cost three parameters -
resume, release, resetSupportClaim - plus a carve-out in rule 4 that let
_fetchActiveSession accept whatever nonce the server happened to return.

It also wasn't the kindness it looked like. _handle_main calls
create_or_replace with a fresh full window, so a new session hands the
user *more* time, not less; re-attaching only preserved the remainder of
a session whose proxy had just died.

Reconnect now disconnects and connects again exactly as the button does,
ad included. All four special cases are deleted and the nonce check is
unconditional.

Costs one rewarded ad to repair an orphaned proxy once ads are enabled.
esef's call, and it buys a single way to start a session.

Also fixes the 3.3.7 regression where Reconnect released the session and
then asked for it back: there is no longer a path that does either.

Co-Authored-By: Claude Opus 5 <[email protected]>

CHANGELOG.md

@@ -5,9 +5,24 @@ Versions follow [semver](https://semver.org/): MAJOR.MINOR.PATCH
 
 ---
 
+## [3.3.8] — 2026-10-17
+
+### Changed
+- **Reconnecting always starts a fresh session.** In SOCKS5 mode, the
+  **Reconnect** button used to re-attach to the session you already had. It now
+  ends that session and starts a new one, exactly as the connect button does —
+  one way to begin a session instead of two, and you get a full window back
+  rather than the remainder of a broken one.
+
+### Fixed
+- **SOCKS5 "Reconnect" works again.** In 3.3.7 it ended your session and then
+  asked for the session it had just ended, failing with "Session not activated".
+
+---
+
 ## [3.3.7] — 2026-10-17
 
-> **Known issue — fixed in the next release.** In SOCKS5 mode, the **Reconnect**
+> **Known issue — fixed in 3.3.8.** In SOCKS5 mode, the **Reconnect**
 > button in Settings ends your session instead of re-attaching to it, and then
 > fails with "Session not activated". It only appears when a proxy session has
 > been orphaned, and you lose the rest of that session rather than anything